rules-nextjs

RISK: dangerouslySetInnerHTML bypasses React's XSS escaping and is the #1 XSS vector in Next.js apps. FIX: render text as children, or sanitize with DOMPurify.sanitize(html) before injecting.

RISK: passing user input to revalidatePath/revalidateTag lets an attacker blow away or target arbitrary cache entries (cache-poisoning / DoS). FIX: map the request to a fixed, server-side allow-list of paths/tags before calling revalidate*.

RISK: reading or setting Next.js internal middleware headers (x-middleware-prefetch/rewrite/override-headers) is how CVE-2025-29927-style bypasses are built. FIX: never trust these headers from the client; rely on the framework to set them and strip them at your reverse proxy.

RISK: eval() or new Function() in a server component / API route turns any string injection into RCE on the Node.js runtime. FIX: parse data with JSON.parse, template with a real templating library, and never evaluate untrusted input.

RISK: getInitialProps is a legacy Pages Router API that disables Automatic Static Optimization and is discouraged in current Next.js. FIX: migrate to getServerSideProps/getStaticProps (Pages Router) or App Router server components with fetch().

RISK: hardcoding NEXTAUTH_SECRET/AUTH_SECRET/JWT_SECRET lets anyone with repo access forge sessions and JWTs. FIX: read it from process.env at runtime and generate a fresh value with `openssl rand -base64 32` for each environment.

RISK: images.unoptimized=true disables the built-in CSRF/SSRF protections of the /_next/image loader and ships unoptimized bytes. FIX: leave it false and configure remotePatterns for each trusted host, or use a dedicated loader.

RISK: `hostname: '*'` in images.remotePatterns/domains turns /_next/image into an open image proxy — attackers can cache-poison and exfiltrate internal URLs. FIX: enumerate each allowed CDN host explicitly (e.g. 'cdn.example.com', 'images.unsplash.com').

RISK: middleware without a config.matcher runs on every request including static assets, amplifying any auth bug and adding latency. FIX: export `export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'] };` and scope it to protected paths.

RISK: rewriting request headers via NextResponse.next({ request: { headers } }) is the technique used in CVE-2025-29927 to bypass middleware. FIX: treat header rewrites as a privileged operation, never copy x-middleware-* headers, and ensure Next.js is on a patched release.

RISK: the x-middleware-subrequest header is the attack vector for CVE-2025-29927 (Next.js middleware authorization bypass). FIX: upgrade Next.js to >=14.2.25 / >=15.2.3, strip this header at the edge/proxy, and never read or forward it in application code.

RISK: any NEXT_PUBLIC_* variable is inlined into the client JS bundle and visible to every visitor — putting a secret there leaks it permanently. FIX: drop the NEXT_PUBLIC_ prefix so it stays server-only, and rotate the exposed value if it has already been deployed.

RISK: passing user-controlled input directly to redirect()/NextResponse.redirect() creates an open-redirect that phishing kits abuse (OWASP A01). FIX: validate the target against an allow-list of internal paths, or require it to start with '/' and reject '//', 'http:', 'https:', 'javascript:' prefixes.

RISK: string-interpolating user input into a SQL template literal is a textbook SQL-injection in a Next.js route handler. FIX: use parameterized queries — `db.query('SELECT * FROM u WHERE id = $1', [id])` or an ORM like Prisma/Drizzle.

RISK: react/react-dom <19.0.1 (or 19.1.x <19.1.2, 19.2.x <19.2.1) contains the React Server Components 'Flight' deserialization RCE (CVE-2025-55182 / CVE-2025-66478). FIX: pin react and react-dom to >=19.0.1 / >=19.1.2 / >=19.2.1 and redeploy.

RISK: a 'use server' module exposes every exported function as an unauthenticated POST endpoint (see CVE-2025-55182/55183/55184). FIX: authenticate the session and authorize the action at the top of every server action, validate all arguments with zod/valibot, and keep react >=19.0.1/19.1.2/19.2.1 and next >=14.2.26/15.2.4.

RISK: a Server Action redirect() to a relative path combined with a spoofed Host header is the root cause of CVE-2024-34351 (SSRF). FIX: upgrade Next.js to >=14.1.1 (or >=14.2.26/15.2.4), or redirect to an absolute, allow-listed URL; never trust req.headers.host for URL construction.

RISK: cookies(), headers(), and draftMode() are async in Next.js 15+ — calling them synchronously works today only via a deprecation shim and will throw in the next major. FIX: `const cookieStore = await cookies();` then call cookieStore.get(...).

RISK: in Next.js 15+, the params and searchParams props are Promises; destructuring them as plain objects silently returns undefined and breaks rendering. FIX: type them as `Promise<{...}>` and `const { id } = await params;` inside the component.